Six days before the European Union’s high-risk AI obligations were due to apply, they stopped being due.
Regulation (EU) 2026/1744, the Digital Omnibus on AI, was published in the Official Journal on July 24, 2026 and entered into force on July 27 [1]. Standalone high-risk systems under Annex III now have until December 2, 2027 — a deferral of sixteen months from the August 2, 2026 date they were days away from meeting. High-risk AI embedded in products already covered by EU product-safety law under Annex I moves from August 2, 2027 to August 2, 2028 [1]. Both are now fixed calendar dates rather than the standards-readiness trigger originally proposed.
What did not move is the part that matters for this post. Article 50 transparency and content-labeling duties, the general-purpose AI provider obligations applicable since August 2025, and the Article 5 prohibited-practices regime in force since February 2025 all kept their dates [1]. The Article 4 AI literacy obligation kept its date too, though its substance was rewritten into a duty to take measures supporting AI literacy rather than to ensure a sufficient level of it [1]. The Act was not delayed. One chapter of it was.
An enterprise that reads that as relief has misread it, and the misreading has a predictable shape: the governance program stands down, the people who understood why each decision was made move to other work, and the program is rebuilt in late 2027 by people reconstructing reasoning from artifacts. The deadline moved. The architecture did not, because the architecture was never responding to the deadline.
Sovereignty is an allocation problem
The instinct in a regulated enterprise is to apply the strictest available control everywhere, on the theory that no auditor ever objected to too much rigor. That instinct is expensive and it is wrong.
McKinsey’s guidance cuts against both extremes: not all aspects of the AI stack need be sovereign, workloads tier along a spectrum according to the opportunity for sovereignty at each, and every move toward greater sovereignty carries trade-offs in performance and cost that must be weighed rather than assumed away [2]. The firm’s own market read is that up to 40% of AI workloads move to sovereign environments — a workload figure, not a spending figure, and the distinction matters because it implies selection rather than wholesale migration [2].
Minimum sufficient sovereignty is the operating principle. Above the mandatory floor described below, each workload gets the degree of control its consequences require and no more, and the assignment is made once, at design time, by an architect who can defend it.
The floor comes first
Before either axis, there is a floor, and architecture does not get to negotiate it.
Jurisdictional, localization, sectoral, and contractual obligations determine where certain data and processing may lawfully occur, and they apply regardless of how consequential the decision is. A patient record, a supervised financial record, or data bound by a customer’s own contractual terms carries custody requirements that do not relax because the workload happens to be mundane. An internal search tool can be entirely inconsequential in decision terms and still be processing data that cannot leave a defined environment.
This is the legal dimension of the four-dimension model the prologue adopted [2], and it is why this series has said throughout that residency is necessary and insufficient — necessary being the operative half here. Independent assurance treats it the same way: recording processing locations appears as a requirement in its own right within the accountability domain of AIUC-1, the AI agent standard published by AIUC [8].
So the sequence is: establish the mandatory custody floor for the data a workload touches, then determine what sovereignty controls are required above it. Residency does not place a workload in a tier. It is the ground the tier is built on, and a tier assignment that ignores it is not an architecture decision but an exposure.
The two axes above the floor
With the floor established, two questions determine what sits on top of it — and neither is “is the data sensitive,” because sensitivity has already done its work below.
What are the consequences of the decision, and are they reversible? A misrouted internal document is recoverable. A declined credit application, a denied claim, or a clinical triage recommendation is not recoverable in the same sense — it produces an effect on a person that persists whether or not the decision is later corrected.
What is the third-party exposure on the write path? Not where the data sits, which the floor has already settled. Who controls the model, who can change it without notice, who can withdraw it, and whether a substitute exists that clears the capability floor.
Cross those and four tiers fall out. Every tier is read as floor plus. This scheme is Luminity’s, not a finding of the cited literature.
Drafting, summarization, internal search. Commodity model access hosted wherever the floor permits, no trace obligation beyond ordinary activity logging. Spending on sovereignty controls above the floor is waste here — but the floor still binds.
Decision support where a human materially reviews the output. Governed model access, recorded inputs and outputs, a named fallback. The fallback need not be rehearsed; the human is the fallback.
Credit, claims, clinical, employment. Full Decision Trace with model version and policy version bound to each decision. An evaluated substitute that has run your evaluation suite. A rehearsed cutover. This is the tier where the Post 3 requirements become mandatory rather than advisable, and it is the tier most enterprises are running today at Tier 1 controls.
Systems whose failure is itself a reportable event. Everything in Tier 2, plus hosted weights you control, plus a decision path that survives the loss of any single external provider.
The tiering decision is an architecture artifact. It is not a legal determination, it does not live in the contract, and it cannot be retrofitted once the seams have set. It also has to be written down, because the question an auditor asks is not whether the tier is correct — it is whether anyone decided.
Sovereignty is bounded by supply
The playbook has a ceiling, and it is worth stating before anyone specifies Tier 3 across a portfolio.
McKinsey finds that only around thirty countries host in-country advanced-AI compute [2]. Stanford HAI’s survey, as of June 2026, identified twenty-five countries where Nvidia has led or supported the establishment of AI factories and eighteen OpenAI for Countries initiatives underway [3]. Those are small numbers, and they describe the supply side of every sovereign commitment an enterprise might make.
The brief’s read of the smaller sovereign-alternative ecosystem sharpens it: most of those providers build on foreign foundations, and even open-weight deployment at scale still requires proprietary hardware and cloud, reducing rather than eliminating upstream dependency [3]. And the infrastructure literature draws a limit that no procurement decision can negotiate around — carbon intensity and water usage function as hard deployment boundaries, with practical sovereignty depending on the capacity to deploy and operate within physical and environmental constraints [4].
So the tier is not a preference. It is a claim about available supply in a specific jurisdiction on a specific timeline, and an architecture that assigns Tier 3 to a workload in a market with no qualifying substrate has produced a wish.
The market has arrived at the write path
Two years ago this argument required explaining. It no longer does, and the confirmation is coming from the demand side rather than from analysts.
On its second-quarter 2026 earnings call, Palantir attributed record growth to enterprise demand for AI sovereignty, framed explicitly as retaining control over data, logic, workflows, and security rather than over location. Chief Revenue and Legal Officer Ryan Taylor described customers as “choosing AI sovereignty over dependency” [5]. Whatever one makes of any single vendor’s positioning, the framing is a write-path framing, offered to investors as the explanation for commercial behavior.
That is worth registering plainly. The claim that sovereignty is architecture is now being made from the architecture literature, the advisory houses, and the vendors’ own investor communications at once. Gartner’s read of the liability environment points the same way, holding that explainability and clean data are becoming non-negotiable as claims over AI-mediated harm accumulate [6]. What remains scarce is not the belief. It is the apparatus — a Decision Architecture that assigns the tier, a Decision Trace that produces the evidence, and an assurance layer separable enough that someone other than the builder can evaluate it. The reference architecture literature is unambiguous that this belongs among quality attributes rather than among compliance obligations [7], which is another way of saying it belongs to the architect.
What to do with sixteen months
The deferral is capacity, and capacity is spent or lost.
Inventory every AI-mediated decision and assign its tier, with the reasoning recorded rather than assumed. Identify which workloads are running at Tier 1 controls and belong at Tier 2 — for most regulated enterprises this is the largest single finding. Instrument the Decision Trace before the volume of decisions makes retrofitting it a migration project. Test one fallback end to end, on a real workload, and discover what breaks while breaking it is cheap. And keep the reasoning legible, because the people who will answer for these systems in December 2027 are not necessarily the people designing them now.
None of that is compliance work. All of it is due on a schedule the regulator does not set.
Forcing every workload to maximum sovereignty wastes capital; assigning no tier at all leaves consequential decisions governed by whatever the integration happened to default to. The tier is an architecture decision above a legal floor — and an enterprise that cannot say which tier a given decision runs at has not made that decision, it has delegated it to whoever configured the connection.
The regulator moved a date. Customers did not move their expectations, boards did not move theirs, and the failure modes this series has described — lock-in discovered at exit, residency mistaken for control, a decision path switched off by a party you never contracted with — are indifferent to the compliance calendar. They were architecture problems in July and they are architecture problems now.
Sovereignty is a write-path property. It is built upstream, into the Decision Architecture, or it is a label on a dependency that never moved. That was the claim this series opened with, and every post since has been an argument for taking it literally.
